diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 7c3a99dd9..b2ec6dc74 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -13,6 +13,8 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  id-token: write
+  actions: write
 
 jobs:
   detect-publishable-packages: